Privacy Policy

Effective date: August 30, 2026

This policy explains how FuzzyCastle LLC ("FuzzyCastle," "we," "us," or "our") processes information when you use our websites, games, apps, accounts, authentication, leaderboards, multiplayer, FuzzyCastle Pass, and related services (collectively, the "Services"). A game-specific policy may provide additional details for that game.

Information we process

• Account and sign-in information: internal account identifiers, display name, account status, security metadata, and a protected mapping to the sign-in provider you select. A FuzzyCastle password account stores its username and a salted password hash, not its plaintext password.
• Provider information: Apple, Google, Discord, or another supported provider may send identifiers and limited profile information during authentication. We use the provider identifier to recognize your account. We may process an email address supplied by a provider or provided for account, support, privacy, or recovery purposes.
• Gameplay information: game identifiers, submitted scores, personal-best and leaderboard information, display names, rankings, and information needed to operate multiplayer rooms and matches.
• Commerce information: FuzzyCastle Pass entitlement status, paid-through and renewal state, Stripe customer, subscription, transaction and event identifiers, transaction amount and currency, refund or dispute state, and related timestamps. Stripe processes payment-card details; FuzzyCastle does not receive or store your full card number.
• Technical and security information: IP address, user agent, device/browser and operating-system information, host and requested path, timestamps, response status, latency, request size, correlation identifiers, and bounded authentication, abuse-prevention, capacity, or error outcomes.
• Information you provide: support messages, privacy requests, and other information you choose to send us.

How we use information

We use information to authenticate users; operate accounts, games, leaderboards, multiplayer and Pass entitlements; process and reconcile purchases; secure the Services; prevent abuse and cheating; diagnose errors; plan capacity; respond to support and privacy requests; maintain business records; and meet legal obligations. We do not sell personal information or use it for targeted advertising.

Public and multiplayer information

Other players may see your display name, score, rank, room participation, turn status, and other multiplayer activity needed to play a supported game. Do not choose a display name that reveals information you do not want other players to see.

Cookies and local storage

We use essential cookies, browser storage, or equivalent application storage for sign-in, security, preferences, cached game state, and core service operation. We do not use Google Analytics or an advertising analytics beacon on the reviewed FuzzyCastle services. Cloudflare may provide aggregate security and traffic measurements. If we later introduce optional analytics, advertising, or other non-essential tracking, we will update our disclosures and obtain consent where required.

Service providers and disclosures

We use service providers to operate the Services, including Google Cloud for hosting, databases, monitoring and logs; Cloudflare for DNS, security, content delivery, static hosting and aggregate traffic information; Stripe for payment processing and subscription management; and the authentication provider you select for sign-in and revocation transactions. These providers process information under their own terms and privacy commitments. We may also disclose information when required by law, to prevent fraud or harm, to protect users or the Services, in connection with a business transaction, or at your direction.

Retention

We retain account and gameplay information while an account remains active and may delete older information sooner as part of normal maintenance. Current operational targets include deleting expired weekly leaderboard data after a 30-day maintenance grace period, retaining bounded account security events for up to 90 days, and retaining completed deletion or display-name workflow records for approximately 30 to 31 days.

When an account is deleted, information associated with it is deleted or de-identified except for limited backup, security, deletion-confirmation, fraud-prevention, payment, tax, accounting, dispute, chargeback, or legally required records. Those records are access-restricted, excluded from ordinary product use, and retained only as long as reasonably necessary for their purpose. De-identified or aggregate information that can no longer identify an account may be retained indefinitely. Provider backup and log retention varies by protected dataset and provider configuration.

Your choices and account deletion

You may initiate account deletion at https://auth.fuzzycastle.com/Account/Delete. Access is revoked when a valid request is accepted. Normal cleanup usually completes sooner, but allow up to 30 days for dependency failures or manual remediation. Limited residual records may remain only as described above.

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, consent withdrawal, or portability, and to complain to a privacy regulator. We may need to verify your identity and authority before acting on a request.

Security and international processing

We use reasonable technical and organizational safeguards, including encrypted transport, protected credentials, access controls, and separation of operational data. No system is completely secure. Information may be processed in the United States and other locations where our providers operate, subject to applicable safeguards.

Children

The Services are not directed to children under 13, or a higher minimum age where required. We do not knowingly collect personal information from a child without required authorization. Contact us if you believe a child has provided personal information contrary to this policy.

Changes and contact

We may update this policy as our Services or legal obligations change. The effective date identifies the current version. For privacy questions or requests, contact fuzzycastle@gmail.com.